Analog 4.13:
Errors and warnings

This section lists all the errors and warnings which analog can produce,
together with a short explanation.

First, you should understand the difference between a crash, an error, a
warning, and a debugging message. First, a crash is when analog exits
prematurely, without producing the whole output file. The system might give a
message, but analog will not give one of its own messages. Analog should never
crash. If it does crash, please tell me about it.

An error is something which stops analog finishing its job. Whenever
an error is detected, analog gives a message starting something like
analog: Fatal error: and will then tell you what type of thing went
wrong before quitting.

A warning is a problem which is not fatal to analog: it will keep on
with its processing. These vary from the possibly serious, such as files which
could not be found, to purely informational. They produce a message starting
analog: Warning. You can turn warnings off using the
WARNINGS command.

Finally, a debugging message gives information on the state of the
program. They just begin with a single code letter followed by a colon. You
don't get any debugging messages unless you've
asked for them.

If you want to send these messages to a file instead of to the screen, you can
use the ERRFILE command.
To tell analog the width of your screen for these messages, you can use the
ERRLINELENGTH command.

Remember that warnings are not fatal: in fact some are rarely even serious.
You can turn them off using the
WARNINGS command. The possible
warnings come in several different categories, shown by a letter in the warning
message. The categories are as follows.

This category indicates an incorrect configuration. Analog will either ignore
what you said, or try and do the best it can with it. There are too many
warnings in this category to list completely. You will have to consult the
documentation for the particular configuration
command that gave an error. If you get an error for a command which used
to work in a previous version of analog, have a look in the section
Updating from older versions.

This is for configurations which might be intended, but which look suspicious.
Analog will not override what you've specified in this case.

LOGFORMAT with no subsequent logfile

You have specified a LOGFORMAT command, but no
subsequent logfile to which it could be applied. Most likely
you put the LOGFORMAT after the LOGFILE command.
You must put the LOGFORMAT before the LOGFILE
command or use DEFAULTLOGFORMAT instead. See the section on
Specifying a log format for
more details.

Offset not a multiple of 30
Offset more than 25 hours

The time offsets are meant to be for
correcting between differences in time zones. These differences are
usually multiples of 30 minutes between -25 and +25 hours. Maybe you
specified the offset in hours instead of minutes by mistake, or
something like that.

FROM time is later than the present

Usually this will mean that no entries are counted. Analog doesn't
try and correct it in case the clock on your computer or your server is
wrong -- but you would be better using
TIMEOFFSET or
LOGTIMEOFFSET to correct
those clocks.

This category is for diagnosing files which couldn't be opened or read
successfully. These can be serious, but most of the messages should be
self-explanatory. There are a few worth mentioning specifically.

Can't auto-detect format of logfile

The LOGFORMAT is set to automatic
detection, but the first line of the logfile is not in any of the
standard formats. This error can often be generated when you try and
specify your own LOGFORMAT but put it after the
LOGFILE command so that it is not in effect for that logfile.

Logfile with ambiguous dates

Some servers, notably IIS and WebSite, record dates in their logfiles
according to local conventions. Then if analog encounters 2/1/99, for
example, it doesn't know whether it's the 2nd January or 1st February.
This problem, and what to do about it, is described in more detail in the
section on
Choosing a logfile.

Failed to open DNS input file

The first time you use DNS lookups, you don't have a DNS cache file, so
you get this warning. Assuming you are using DNS WRITE, the
message will go away next time you run analog.

DNS lock file already exists

To stop two copies of analog trying to write the DNS file at the same
time, an empty "lock file" is created, which tells the second
copy of analog to use DNS LOOKUP instead of DNS
WRITE. If analog crashes, it may not delete its lock file. So if you
get the "already exists" message even though no other copy of
analog is running, you may need to delete the lock file yourself.

When analog finishes reading a logfile, it checks whether there might have
been something wrong with it.

Large number of corrupt lines

This could indicate a problem with the logfile, or with the
LOGFORMAT specification.
The possible causes are described in the section about
Choosing a logfile.

Logfiles overlap: possible double counting

Two logfiles which were counting the same type of item overlapped in
time. Maybe you read two copies of the same logfile. Or maybe the
LOGFORMAT specification
should
have told analog to ignore some of the items. Or it could be that the
logfiles are in fact disjoint and there wasn't really a problem: analog
only checks the dates of the logfiles, not the details of them. In this
last case, the statistics produced will still be correct.

This category is for warnings about logfile formats which might make analog
produce unexpected results.

Logfile contains lines with no [whatevers], which are being
filtered

This is usually harmless. It is perhaps best explained by
example. Suppose you are excluding certain
files from the analysis, but that you are also analysing a browser log
which just contains information about the browsers used, not which files
they read. Then we can't exclude the browsers which read the excluded
files, because we don't know which they were, so all browsers will be
included.

If a logfile line doesn't contain a file name, analog will assume that
the request wasn't for a page. Similarly, if it doesn't give the number
of bytes transferred, analog will make the bytes zero. So the number of
page requests or bytes credited to the other items on that line will
then be too low.

This is used when analog turns off an empty report. This could be because none
of the relevant items were included in any of the logfiles, or perhaps
beacause a LOWMEM command stopped them
being recorded.

This is not an analog-generated warning, but it can result from analog closing
a logfile it's uncompressing without reading the whole of it, when it
determines that it will not need it.
Go to the analog home page.